PUA.Win64.XMRig.KBD

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

概要:プログラムは、コンピュータのCPUおよびGPUのリソースを利用して仮想通貨を発掘します。

侵入方法

プログラムは、他のマルウェアに作成されるか、悪意あるWebサイトからユーザが誤ってダウンロードすることによりコンピュータに侵入します。

その他

プログラムが自身の不正活動を実行するためには、以下のコンポーネントが必要になります。

• {Coinminer Directory}\config.json

プログラムは、以下を実行します。

• It accepts the following Parameters:
  • -o, --url=URL URL of mining server
  • -a, --algo=ALGO mining algorithm https://{BLOCKED}g.com/docs/algorithms
  • --coin=COIN specify coin instead of algorithm
  • -u, --user=USERNAME username for mining server
  • -p, --pass=PASSWORD password for mining server
  • -O, --userpass=U:P username:password pair for mining server
  • -x, --proxy=HOST:PORT connect through a SOCKS5 proxy
  • -k, --keepalive send keepalived packet for prevent timeout (needs pool support)
  • --nicehash enable nicehash.com support
  • --rig-id=ID rig identifier for pool-side statistics (needs pool support)
  • --tls enable SSL/TLS support (needs pool support)
  • --tls-fingerprint=HEX pool TLS certificate fingerprint for strict certificate pinning
  • --daemon use daemon RPC instead of pool for solo mining
  • --daemon-poll-interval=N daemon poll interval in milliseconds (default: 1000)
  • --self-select=URL self-select block templates from URL
  • -r, --retries=N number of times to retry before switch to backup server (default: 5)
  • -R, --retry-pause=N time to pause between retries (default: 5)
  • --user-agent set custom user-agent string for pool
  • --donate-level=N donate level, default 1%% (1 minute in 100 minutes)
  • --donate-over-proxy=N control donate over xmrig-proxy feature
  • --no-cpu disable CPU mining backend
  • -t, --threads=N number of CPU threads
  • -v, --av=N algorithm variation, 0 auto select
  • --cpu-affinity set process affinity to CPU core(s), mask 0x3 for cores 0 and 1
  • --cpu-priority set process priority (0 idle, 2 normal to 5 highest)
  • --cpu-max-threads-hint=N maximum CPU threads count (in percentage) hint for autoconfig
  • --cpu-memory-pool=N number of 2 MB pages for persistent memory pool, -1 (auto), 0 (disable)
  • --cpu-no-yield prefer maximum hashrate rather than system response/stability
  • --no-huge-pages disable huge pages support
  • --asm=ASM ASM optimizations, possible values: auto, none, intel, ryzen, bulldozer
  • --argon2-impl=IMPL argon2 implementation: x86_64, SSE2, SSSE3, XOP, AVX2, AVX-512F
  • --randomx-init=N threads count to initialize RandomX dataset
  • --randomx-no-numa disable NUMA support for RandomX
  • --randomx-mode=MODE RandomX mode: auto, fast, light
  • --randomx-1gb-pages use 1GB hugepages for RandomX dataset (Linux only)
  • --randomx-wrmsr=N write custom value(s) to MSR registers or disable MSR mod (-1)
  • --randomx-no-rdmsr disable reverting initial MSR values on exit
  • --randomx-cache-qos enable Cache QoS
  • --astrobwt-max-size=N skip hashes with large stage 2 size, default: 550, min: 400, max: 1200
  • --astrobwt-avx2 enable AVX2 optimizations for AstroBWT algorithm
  • --opencl enable OpenCL mining backend
  • --opencl-devices=N comma separated list of OpenCL devices to use
  • --opencl-platform=N OpenCL platform index or name
  • --opencl-loader=PATH path to OpenCL-ICD-Loader (OpenCL.dll or libOpenCL.so)
  • --opencl-no-cache disable OpenCL cache
  • --print-platforms print available OpenCL platforms and exit
  • --cuda enable CUDA mining backend
  • --cuda-loader=PATH path to CUDA plugin (xmrig-cuda.dll or libxmrig-cuda.so)
  • --cuda-devices=N comma separated list of CUDA devices to use
  • --cuda-bfactor-hint=N bfactor hint for autoconfig (0-12)
  • --cuda-bsleep-hint=N bsleep hint for autoconfig
  • --no-nvml disable NVML (NVIDIA Management Library) support
  • --api-worker-id=ID custom worker-id for API
  • --api-id=ID custom instance ID for API
  • --http-host=HOST bind host for HTTP API (default: {BLOCKED}.{BLOCKED}.0.1)
  • --http-port=N bind port for HTTP API
  • --http-access-token=T access token for HTTP API
  • --http-no-restricted enable full remote access to HTTP API (only if access token set)
  • --tls-gen=HOSTNAME generate TLS certificate for specific hostname
  • --tls-cert=FILE load TLS certificate chain from a file in the PEM format
  • --tls-cert-key=FILE load TLS certificate private key from a file in the PEM format
  • --tls-dhparam=FILE load DH parameters for DHE ciphers from a file in the PEM format
  • --tls-protocols=N enable specified TLS protocols, example: \"TLSv1 TLSv1.1 TLSv1.2 TLSv1.3\"
  • --tls-ciphers=S set list of available ciphers (TLSv1.2 and below)
  • --tls-ciphersuites=S set list of available TLSv1.3 ciphersuites
  • -l, --log-file=FILE log all output to a file
  • --print-time=N print hashrate report every N seconds
  • --health-print-time=N print health report every N seconds
  • --no-color disable colored output
  • --verbose verbose output
  • -c, --config=FILE load a JSON-format configuration file
  • -B, --background run the miner in the background
  • -V, --version output version information and exit
  • -h, --help display this help and exit
  • --dry-run test configuration and exit
  • --export-topology export hwloc topology to a XML file and exit
  • --title set custom console window title
  • --no-title disable setting console window title
  • --pause-on-battery pause mine on battery power
  • --stress run continuous stress test to check system stability
  • --bench=N run benchmark in offline mode, N can be between 1M and 10M
  • --help display this help and exit
  • --version output version information and exit
  • --export-topology export hwloc topology to a XML file and exit
  • --print-platforms print available OpenCL platforms and exit
  
  
• Supported algorithm options:
  • argon2/chukwa
  • argon2/chukwav2
  • argon2/wrkz
  • astrobwt
  • astrobwt/dero
  • chukwa
  • chukwav2
  • cryptonight
  • cryptonight-aeonv7
  • cryptonight-bittube2
  • cryptonight-heavy
  • cryptonight-heavy/0
  • cryptonight-heavy/tube
  • cryptonight-heavy/xhv
  • cryptonight-light
  • cryptonight-lite
  • cryptonight-lite/0
  • cryptonight-lite/1
  • cryptonight-monerov7
  • cryptonight-monerov8
  • cryptonight-pico
  • cryptonight-pico/tlo
  • cryptonight-pico/trtl
  • cryptonight-talleo
  • cryptonight-turtle
  • cryptonight-ultralite
  • cryptonight/0
  • cryptonight/1
  • cryptonight/2
  • cryptonight/ccx
  • cryptonight/conceal
  • cryptonight/double
  • cryptonight/fast
  • cryptonight/gpu
  • cryptonight/half
  • cryptonight/msr
  • cryptonight/r
  • cryptonight/rto
  • cryptonight/rwz
  • cryptonight/ultra
  • cryptonight/xao
  • cryptonight/zls
  • cryptonight_alloy
  • cryptonight_gpu
  • cryptonight_haven
  • cryptonight_lite_v7
  • cryptonight_r
  • cryptonight_talleo
  • cryptonight_turtle
  • cryptonight_v7
  • cryptonight_v8
  • kawpow
  • kawpow/rvn
  • panthera
  • RandomARQ
  • RandomKEVA
  • RandomSFX
  • RandomWOW
  • RandomX
  • randomx/0
  • randomx/arq
  • randomx/keva
  • randomx/sfx
  • randomx/test
  • randomx/wow
  
  
• Supported coin options:
  • monero
  • arqma
  • dero
  • keva
  • ravencoin
  • conceal
• It connects to the following mining pool:
  • mine.{BLOCKED}l.com:13333
  • {BLOCKED}.{BLOCKED}.73.178:13333
  • {BLOCKED}.{BLOCKED}.4.91:13333
  • {BLOCKED}.{BLOCKED}.195.181.vultr.com:13333

詳細:プログラムは、コンピュータのCPUおよびGPUのリソースを利用して仮想通貨を発掘します。その結果、感染コンピュータの動作が非常に遅くなります。